In theory, string handling in C is straightforward enough. In practice, string handling in C is the source of a crazy number of security vulnerabilities and other bugs, even in popular and relatively well regarded software written by experts.

No-one should still need to use C in 2016. We know how to fix many of its problems and create much better programming languages now. Unfortunately, there is so much momentum behind the C ecosystem that in reality there are few practical alternatives yet, at least for low-level systems programming or high-performance number crunching work. Worse, there may not be enough commercial justification for the few organisations big enough to significantly move the industry in a better direction to actually commit the resources to do so, and this seems unlikely to change unless and until influential people start to care about the real costs of poor quality software.